Notifications
Clear all
Topic starter
02/08/2026 12:32 pm
TL;DR: A simple Google Calendar invite containing indirect prompt injection could hijack Gemini for Workspace agents to spam users, delete calendar events, geolocate victims, stream video, and trigger physical actions, according to SafeBreach. The finding shows that LLM-powered assistants can turn everyday collaboration data into an execution path, making prompt and tool governance a core security requirement, with 73% of identified Promptware threats rated high-critical.
NHIMG editorial — based on content published by SafeBreach: Invitation Is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite
By the numbers:
- 73% of the identified Promptware threats are classified as High-Critical risk and require the deployment of immediate mitigations.
- 17 minutes, redentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when an AI assistant can access private data and untrusted content at the same time?
A: When an assistant can access private data and ingest untrusted content, a small injected instruction can become a data-exfiltration path.
Q: Why do conversational AI systems create new identity and access risks?
A: Because they can combine data retrieval, decision-making, and execution in a single interaction.
Q: How do teams know whether prompt injection controls are actually working?
A: Look for end-to-end visibility across prompts, retrieved content, memory, tool calls, and outputs, plus evidence that blocked actions stay blocked under realistic test cases.
Practitioner guidance
- Map assistant tool permissions by impact tier Catalogue every action Gemini-style assistants can take through calendars, mail, files, voice, and home or business integrations.
- Block untrusted instruction surfaces from becoming trusted context Treat calendar invites, shared documents, emails, and chat messages as untrusted content when they are parsed by an LLM.
- Add sensitive-action confirmations before tool execution Require explicit user confirmation before actions such as deleting events, sending messages, exfiltrating data, or controlling connected devices.
What's in the full report
SafeBreach's full research covers the technical exploit paths and proof-of-concept details this post intentionally leaves at a higher level:
- Step-by-step promptware techniques used against Gemini for Workspace web, mobile, and voice interfaces
- Detailed examples of malicious actions triggered through calendar, email, and connected-device tools
- Threat analysis and risk assessment methodology used to classify the identified Promptware threats
- Vendor response details and mitigation observations shared during responsible disclosure
👉 Read SafeBreach's analysis of Targeted Promptware attacks against Gemini for Workspace →
Targeted promptware and Gemini agents: what do defenders need to change?
Explore further
02/08/2026 1:29 pm
Promptware should be treated as an identity-governance problem, not just an LLM safety problem. The article shows that once an assistant can read untrusted content and act through connected tools, the core question becomes who or what is authorised to trigger those actions. That places the issue squarely in IAM, PAM, and NHI governance, because the assistant is effectively operating as a software identity with delegated scope. The practitioner conclusion is that AI security controls must be designed as access controls, not only content filters.
A question worth separating out:
Q: Who is accountable when a compromised AI agent misuses delegated access?
A: Accountability usually spans the business owner of the workflow, the team that issued or approved the credential, and the vendor if a third-party integration was involved. The critical governance question is not who logged in, but who allowed the delegation chain to exist and remain valid. That chain must be documented before incidents occur.
👉 Read our full editorial: Targeted promptware turns Google Calendar into an AI control channel
